You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
119 lines
5.6 KiB
119 lines
5.6 KiB
AUDIT HOST — MAIN WEBSERVER |
|
============================ |
|
Tanggal audit : 2026-06-10 |
|
Sumber : server/host.txt |
|
Metode : SSH langsung |
|
|
|
IP/SSH : 10.100.1.41 | ssh -m hmac-sha1 Administrator@10.100.1.41 -p 22 |
|
Hostname : app |
|
OS : Microsoft Windows Server 2012 R2 Standard (Version 6.3.9600) |
|
Resource : RAM ~16 GiB (free ~12 GiB) | Disk C: ~128 GiB (free ~61 GiB, ~47% used) |
|
|
|
Peran host: web server utama Geonet — IIS, aplikasi GIS/portal, dev stack lokal. |
|
|
|
|
|
A. STATUS SSH |
|
------------- |
|
| Item | Hasil | |
|
|-------------------|--------------------------------------------| |
|
| OpenSSH | OpenSSH_for_Windows_10.0p2 (Win32-OpenSSH) | |
|
| Service sshd | RUNNING | |
|
| Port | 22 (0.0.0.0) | |
|
| Login private key | BERHASIL (tanpa password) | |
|
| User | app\administrator | |
|
| Key file server | C:\ProgramData\ssh\administrators_authorized_keys | |
|
|
|
Perintah host.txt sudah benar dan verified. |
|
|
|
|
|
B. LAYANAN UTAMA (Windows Service) |
|
---------------------------------- |
|
| Service | Fungsi | Status | |
|
|----------------------|-------------------------------------|----------| |
|
| W3SVC / IISADMIN | IIS — World Wide Web Publishing | RUNNING | |
|
| WAS | Windows Process Activation Service | RUNNING | |
|
| WMSVC | Web Management Service | RUNNING | |
|
| sshd | OpenSSH SSH Server | RUNNING | |
|
| mosquitto | MQTT Broker | RUNNING | |
|
| Zabbix Agent | Monitoring agent | RUNNING | |
|
| vncserver | VNC remote desktop | RUNNING | |
|
| TermService | Remote Desktop (RDP) | RUNNING | |
|
| WinRM | PowerShell Remoting | RUNNING | |
|
| MSMQ | Message Queuing | RUNNING | |
|
| Netlogon | Domain member (Active Directory) | RUNNING | |
|
|
|
Tomcat tidak terdeteksi sebagai Windows service (Tomcat8/Tomcat9 tidak ada), |
|
tetapi port Tomcat (8080, 8443, 8009) aktif — kemungkinan dijalankan manual atau sebagai app. |
|
|
|
|
|
C. IIS SITES |
|
------------ |
|
| Site | Port binding | Status | |
|
|-----------------------|---------------------------------------|---------| |
|
| Default Web Site | 80, 443 | Started | |
|
| ts.gisportal.id | 81 (HTTP), 82 (HTTPS) | Started | |
|
| imp.gisportal.id | 100 (HTTPS) | Started | |
|
| leantime.gisportal.id | 101 (HTTPS), 102 (HTTP) | Started | |
|
| widget | 83 (HTTP), 84 (HTTPS) | Started | |
|
|
|
Config tool: %windir%\system32\inetsrv\appcmd |
|
|
|
|
|
D. PORT LISTENING PENTING |
|
------------------------- |
|
| Port | Kemungkinan layanan | |
|
|--------|----------------------------------------------| |
|
| 22 | OpenSSH | |
|
| 80 | IIS HTTP | |
|
| 81-84 | IIS sites (ts, widget) | |
|
| 100-102| IIS sites (imp, leantime) | |
|
| 443 | IIS HTTPS | |
|
| 1883 | Mosquitto MQTT | |
|
| 3000 | App/dev server | |
|
| 3389 | (via TermService — RDP) | |
|
| 5900 | VNC | |
|
| 5985 | WinRM | |
|
| 8080 | Tomcat / Java app | |
|
| 8443 | Tomcat HTTPS / Java app | |
|
| 9080 | Java / secondary web | |
|
| 9443 | Java HTTPS | |
|
| 10050 | Zabbix Agent | |
|
|
|
|
|
E. APLIKASI & FOLDER PENTING (C:\) |
|
---------------------------------- |
|
| Path / folder | Keterangan | |
|
|-------------------------|-----------------------------------------| |
|
| C:\inetpub\wwwroot\ | Default IIS web root — portal, GIS apps | |
|
| C:\laragon\ | Laragon dev stack (PHP/MySQL local) | |
|
| C:\laragon-2026\ | Laragon versi/update | |
|
| C:\xampp\ | XAMPP stack | |
|
| C:\Gitea\ | Gitea Git server (gitea.exe) | |
|
| C:\nginx-rtmp-win32-dev\| Nginx RTMP (streaming) | |
|
| C:\app\ | Aplikasi custom | |
|
|
|
Contoh app di wwwroot: portal, arcgis, eSearch, eBasemapGallery, mooview, |
|
FieldResumeWKP, WellSitePrep, speed, widget, exbwidget, dll. |
|
|
|
|
|
F. ANALISA |
|
---------- |
|
Peran: server produksi web + GIS portal (*.gisportal.id beberapa site host lokal). |
|
Stack campuran IIS + Java/Tomcat + Laragon/XAMPP + Gitea + MQTT. |
|
|
|
Reverse proxy (10.100.1.24) mem-proxy banyak domain ke host ini via nginx |
|
(contoh di reverse-proxy-audit: app, arc, asset, maps, simp, stream, dll). |
|
|
|
Catatan: |
|
- Windows Server 2012 R2 sudah EOL — rencanakan upgrade. |
|
- Banyak port web expose ke 0.0.0.0; pastikan firewall Mikrotik membatasi. |
|
- Laragon/XAMPP/Gitea di server produksi — verifikasi apakah masih dipakai aktif. |
|
- SSH sudah OK dengan private key via administrators_authorized_keys. |
|
|
|
|
|
PERINTAH VERIFIKASI ULANG |
|
------------------------- |
|
ssh -m hmac-sha1 Administrator@10.100.1.41 -p 22 "hostname" |
|
ssh -m hmac-sha1 Administrator@10.100.1.41 -p 22 "sc query W3SVC sshd" |
|
ssh -m hmac-sha1 Administrator@10.100.1.41 -p 22 "%windir%\system32\inetsrv\appcmd list site" |
|
ssh -m hmac-sha1 Administrator@10.100.1.41 -p 22 "netstat -an | findstr LISTENING"
|
|
|